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DETAILED ACTION 

Continued Examination Under 37 CFR 1.114 

1 . A request for continued examination under 3 7 CFR 1.114, including the fee set forth in 
37 CFR 1 .17(e), was filed in this application after final rejection. Since this application is 
eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) 
has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 
37 CFR 1.1 14. Applicant's submission filed on 10/03/2007 has been entered. 

2. This communication is responsive to Amendment filed 10/03/2007. 
Claims 1-23 are pending in this application. This action is made non-Final. 

Claim Rejections - 35 USC §102 

3. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the 
basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless: 
(e) the invention was described in 

(1) an application for patent, published under section 122(b), by another filed in the United States before 
the invention by the applicant for patent or 

(2) a patent granted on an application for patent by another filed in the United States before the invention 
by the applicant for patent, except that an international application filed under the treaty defined in section 
351(a) shall have the effects for purposes of this subsection of an application filed in the United States only 
if the international application designated the United States and was published under Article 21(2) of such 
treaty in the English language. 

4. Claims 1, 3-10, 12, 13, 15-21, 23 are rejected under 35 U.S.C. 102(e) as being anticipated 
by Coupal et al. (US Patent No. 6,931,574). 
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Coupal anticipated independent claims 1, 9, 13, 21 by the following: 

As per claim 1, Coupal teaches a method/an article of manufacture comprising: 

querying a file that defines a protocol (i.e. protocol definition file, col. 10. lines 33-45) for 
which protocol support is to be added to a network traffic generation and analysis tool to process 
network traffic (i.e. the relevant protocol definition file would be loaded into the protocol 
database 34 (FIG. 4) for use by the analyzer 12, col. 10, lines 33-45); 

determining from the queried file how packets for the protocol are constructed (i.e. the 
protocol editor is used to prepare a series of predefined protocol definition constructs that can 
be used to preferably accomplish several objectives. First, the constructs provide the ability to 
define the data frame corresponding to the relevant physical layer protocol, such as the 
components of the frame header, etc. Second, the constructs preferably provide high level 
descriptions that can be displayed to a user to describe the various fields of the frame and its 
contents. Third, the constructs provide a means for identifying and describing the various 
protocol layer messages that are contained within the payload of physical layer data frame, as 
well as the relationships between these various protocol layers— again, in a manner that is 
descriptive to a human user, col. 10, line 46 to col. 11, line 8); 

building a protocol runtime specification (i.e. the format of a network data frame, col. 9, 
lines 34-55) based on how packets for the protocol are constructed (i.e. a user would define the 
data frame of a given physical layer protocol, as well as all of the higher level protocol 
permutations, using the definition constructs, col. 4, lines 41-57), the protocol runtime 
specification specifying how packets for the protocol are processed by the network traffic 
generation and analysis tool (i.e. a protocol analyzer device, col. 4, lines 5-32); 



Application/Control Number: 1 0/669,31 1 Page 4 

Art Unit: 2167 

receiving packets for the protocol (i.e. utilize the protocol definition file to interpret 
captured data packets, col. 4, lines 41-57); and 

processing data from the received packets in the network traffic generation and analysis 
tool in accordance with the protocol runtime specification, including translating (i.e. it is 
desirable for this information content to be translated into a higher level, user understandable 
format, so as to provide a useful set of information for analysis of the network, col. 10, lines 6- 
20) data from the received packets into a format for analyzing traffic in the network traffic 
generation and analysis tool (i.e. the network analyzer 12 obtains a data frame from the network 
30. As is well know, this functionality is provided by way of the network interface module 14, 
which obtains serial data from the physical medium of the network 30, and segments the data 
into data frames in accordance with the particular physical layer protocol of the interface 
module 14, col. 11, lines 20-31; the analyzer interprets the frame in accordance with the 
contents of the protocol definition file previously defined and stored in the protocol data base 34. 
In addition, the frame's contents are displayed in the manner prescribed by the protocol 
definition file, including, preferably, with some type of description using a higher-level, user 
understandable format 34, col. 11, lines 32-52). 

As per claim 9, Coupal teaches an apparatus comprising: 

a storage element (Fig. 1) to store a file that defines a protocol for which protocol support 
is to be added to a network traffic generation and analysis tool to process network traffic (i.e. the 
relevant protocol definition file would be loaded into the protocol database 34 (FIG. 4) for use 
by the analyzer 12, col. 10, lines 33-45); 
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a translation unit (i.e. a protocol analyzer device, col. 4, lines 5-32) coupled to the storage 
element to query the file to determine how packets for the protocol are constructed and to build a 
protocol runtime specification for the protocol (i.e. the network analyzer 12 obtains a data frame 
from the network 30. As is well know, this functionality is provided by way of the network 
interface module 14, which obtains serial data from the physical medium of the network 30, and 
segments the data into data frames in accordance with the particular physical layer protocol of 
the interface module 14, col. 11, lines 20-31), the protocol runtime specification (i.e. the format 
of a network data frame, col. 9, lines 34-55) specifying how packets for the protocol are 
processed by the network traffic generation and analysis tool (i.e. a user would define the data 
frame of a given physical layer protocol, as well as all of the higher level protocol permutations, 
using the definition constructs, col. 4, lines 41-57); and 

the translation unit further to receive packets for the protocol and to process data from the 
received packets in the network traffic generation and analysis tool in accordance with the 
protocol runtime specification, including translating (i.e. it is desirable for this information 
content to be translated into a higher level, user understandable format, so as to provide a useful 
set of information for analysis of the network, col. 10, lines 6-20) data from the received packets 
into a format for analyzing traffic in the network traffic generation and analysis tool (i.e. the 
analyzer interprets the frame in accordance with the contents of the protocol definition file 
previously defined and stored in the protocol data base 34. In addition, the frame's contents are 
displayed in the manner prescribed by the protocol definition file, including, preferably, with 
some type of description using a higher-level, user understandable format 34, col. 11, lines 32- 
52). 
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As per claim 13, Coupal teaches an article of manufacture comprising: 

a machine accessible medium (see Fig.l) including content that when accessed by a 
machine causes the machine to: 

query a file that defines a protocol (i.e. protocol definition file, col. 10. lines 33-45) for 
which protocol support is to be added to a network traffic generation and analysis tool to process 
network traffic (i.e. the relevant protocol definition file would be loaded into the protocol 
database 34 (FIG. 4) for use by the analyzer 12, col. 10, lines 33-45); 

determine from the queried file how packets for the protocol are constructed (i.e. the 
protocol editor is used to prepare a series of predefined protocol definition constructs that can 
be used to preferably accomplish several objectives. First, the constructs provide the ability to 
define the data frame corresponding to the relevant physical layer protocol, such as the 
components of the frame header, etc. Second, the constructs preferably provide high level 
descriptions that can be displayed to a user to describe the various fields of the frame and its 
contents. Third, the constructs provide a means for identifying and describing the various 
protocol layer messages that are contained within the payload of physical layer data frame, as 
well as the relationships between these various protocol layers— again, in a manner that is 
descriptive to a human user, col. 10, line 46 to col. 11, line 8); 

build a protocol runtime specification (i.e. the format of a network data frame, col. 9, 
lines 34-55) based on how packets for the protocol are constructed (i.e. a user would define the 
data frame of a given physical layer protocol, as well as all of the higher level protocol 
permutations, using the definition constructs, col. 4, lines 41-57), the protocol runtime 
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specification specifying how packets for the protocol are processed by the network traffic 
generation and analysis tool (i.e. a protocol analyzer device, col. 4, lines 5-32); 

receive packets for the protocol (i.e. utilize the protocol definition frie to interpret 
captured data packets, col. 4, lines 41-57); and 

process data from the received packets in the network traffic generation and analysis tool 
in accordance with the protocol runtime specification, including translating (i.e. it is desirable for 
this information content to be translated into a higher level, user understandable format, so as to 
provide a useful set of information for analysis of the network, col. 10, lines 6-20) data from the 
received packets into a format for analyzing traffic in the network traffic generation and analysis 
tool (i.e. the network analyzer 12 obtains a data frame from the network 30. As is well know, this 
functionality is provided by way of the network interface module 14, which obtains serial data 
from the physical medium of the network 30, and segments the data into data frames in 
accordance with the particular physical layer protocol of the interface module 14, col. 11, lines 
20-31; the analyzer interprets the frame in accordance with the contents of the protocol 
definition file previously defined and stored in the protocol data base 34. In addition, the frame 's 
contents are displayed in the manner prescribed by the protocol definition file, including, 
preferably, with some type of description using a higher-level, user understandable format 34, 
col. 11, lines 32-52). 

As per claim 21, Coupal teaches a system comprising: 

a storage element (Fig. 1) to store a file that defines a protocol for which protocol support 
is to be added to a network traffic generation and analysis tool to process network traffic (i.e. the 
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relevant protocol definition file would be loaded into the protocol database 34 (FIG. 4) for use 
by the analyzer 12, col. 10, lines 33-45); 

a translation unit (i.e. a protocol analyzer device, col. 4, lines 5-32) coupled to the storage 
element to query the file to determine how packets for the protocol are constructed and to build a 
protocol runtime specification for the protocol (i.e. the network analyzer 12 obtains a data frame 
from the network 30. As is well know, this functionality is provided by way of the network 
interface module 14, which obtains serial data from the physical medium of the network 30, and 
segments the data into data frames in accordance with the particular physical layer protocol of 
the interface module 14, col. 11, lines 20-31), the protocol runtime specification (i.e. the format 
of a network data frame, col. 9, lines 34-55) specifying how packets for the protocol are 
processed by the network traffic generation and analysis tool (i.e. a user would define the data 
frame of a given physical layer protocol, as well as all of the higher level protocol permutations, 
using the definition constructs, col. 4, lines 41-57), the translation unit further to receive packets 
for the protocol and to process data from the received packets in the network traffic generation 
and analysis tool in accordance with the protocol runtime specification, including translating (i.e. 
it is desirable for this information content to be translated into a higher level, user 
understandable format, so as to provide a useful set of information for analysis of the network, 
col. 10, lines 6-20) data from the received packets into a format for analyzing traffic in the 
network traffic generation and analysis tool (i.e. the analyzer interprets the frame in accordance 
with the contents of the protocol definition file previously defined and stored in the protocol data 
base 34. In addition, the frame 's contents are displayed in the manner prescribed by the protocol 
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definition file, including, preferably, with some type of description using a higher-level, user 
understandable format 34, col. 11, lines 32-52); 

a network interface coupled to the translation unit (i.e. The protocol analyzer device 12 
illustrated in FIG. 1 also includes a network interface card (NIC) 14 that allows for the physical 
and electrical interconnection with the network 30, as is depicted schematically at 24, col. 8, 
lines 41-54); and 

a network driver (i.e. the packet analysis software module, col. 8, line 55 to col. 9, line 
14) coupled to the network interface. 

As to claims 3, 12, 15, 23, Coupal teaches determining from the file how to display one 
or more user interface elements (i.e. FIG. 11 illustrates yet another graphics Window illustrating 
some of these concepts. Here, the field "Ver" (at 190) is selected by the user within the 
hierarchical tree on the left-hand side 104 of the Window, and highlighted. The properties of 
"Ver" are displayed in the top-right panel 192. The result panel 194 of the window displays the 
current offset of 3 words 2 bytes for that field inside an Ethernet frame, represented at 196. The 
result panel 194 also highlights that the first two bytes of the fourth Ethernet frame word need to 
be 0x0800 (at 198) in order to have an IP header with the "Ver" field, col. 22, lines 3-13). 

As to claims 4, 16, Coupal teaches determining from the queried file how packets for the 
protocol are constructed comprises determining whether there are one or more protocol 
encapsulations (i.e. the protocol definition allows for all of the protocol stacks that may be 
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contained within the physical data frame to also be identified and also described in an 
understandable format, col. 4, lines 5-32). 

As to claims 5, 17, Coupal teaches determining from the queried file how packets for the 
protocol are constructed (i.e. each captured data frame is interpreted in accordance with the 
definitions provided by the definition constructs, col. 9, lines 34-55) comprises determining a 
field type of one or more fields for the protocol (i.e. This preamble is followed by a "destination 
address "field 51, which designates the unique address of the network connected device that is to 
receive the data frame. Next is the "source address" field 53, which designates the unique 
address of the device that sent the data frame. Each of these address fields contain the Medium 
Access Control ("MAC") addresses of the source and destination devices on the network 30, col. 
11, lines 32-52). 

As to claims 6, 18, Coupal teaches determining from the queried file how packets for the 
protocol are constructed comprises determining a field size of one or more fields for the protocol 
(i.e. The Ethernet data frame begins with an 8-byte preamble field (which is not shown in this 
illustration), which is used for synchronization purposes. This preamble is followed by a 
"destination address" field 51, which designates the unique address of the network connected 
device that is to receive the data frame. Next is the "source address "field 53, which designates 
the unique address of the device that sent the data frame. Each of these address fields contain the 
Medium Access Control ("MAC") addresses of the source and destination devices on the network 
30. The MAC address is a unique address hardwired into the station's network interface card, 
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such as that shown at 14 in FIG. 1. For the Ethernet protocol, each address is 6 bytes (48-bits) 
in length, col. 9, lines 34-55). 

As to claims 7, 19, Coupal teaches determining from the queried file how packets for the 
protocol are constructed comprises determining a default value of one or more fields for the 
protocol (i.e. an 8-byte preamble field, col. 9, lines 34-55; The last field is a 4 byte frame 
sequence ("FCS") 56, which is used for error detection, col. 9, line 63 to col. 10, line 5). 

As to claims 8, 20, Coupal teaches determining from the queried file how packets for the 
protocol are constructed comprises determining whether there is a calculation to be performed 
for one or more fields of the protocol (i.e. Header Checksum, col. 24). 

As per claim 10, Coupal teaches the apparatus of claim 9, further comprising a network 
interface couple to the translation unit (i.e. The protocol analyzer device 12 illustrated in FIG. 1 
also includes a network interface card (NIC) 14 that allows for the physical and electrical 
interconnection with the network 30, as is depicted schematically at 24, col. 8, lines 41-54). 

Claim Rejections - 35 USC §103 

5. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 



Application/Control Number: 1 0/669,31 1 Page 1 2 

Art Unit: 2167 

This application currently names joint inventors. In considering patentability of the claims 
under 35 U.S.C. 103(a), the examiner presumes that the subject matter of the various claims 
was commonly owned at the time any inventions covered therein were made absent any 
evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1 .56 to point 
out the inventor and invention dates of each claim that was not commonly owned at the time 
a later invention was made in order for the examiner to consider the applicability of 35 
U.S.C. 103(c) and potential 35 U.S.C. 102(e), (f) or (g) prior art under 35 U.S.C. 103(a). 

6. Claims 2, 1 1, 14, 22 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Coupal et al. (US Patent No. 6,93 1,574), in view of Harvey et al. (US Patent No. 7,054,924). 

As per claim 2, 11, 14, 22, Coupal does not specifically teach the file is written in an 
Extensible Markup Language (XML). 

Harvey teaches the file is written in an Extensible Markup Language (XML) (See Table 
2, col. 16). 

It would have been obvious to one of ordinary skill of the art having the teaching of 
Coupal and Harvey at the time the invention was made to modify the system of Coupal to 
include the file is written in an Extensible Markup Language (XML) as taught by Harvey. One of 
ordinary skill in the art would be motivated to make this combination in order to configuration 
and management of computer network devices in view of Harvey (See FIELD OF INVENTION), 
as doing so would give the added benefit of accomplishing automatic network provisioning 
without requiring a skilled technician to visit customer premises to carry out configuration as 
taught by Harvey (col. 2, lines 51-65). 
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Response to Arguments 

7. Applicant's arguments regarding "Applicant has further clarified in the independent 
claims that the protocol runtime specification that is built based on how packets for a protocol 
are constructed, further specifies how packets for that protocol should be processed by the 
network traffic generation and analysis tool, including how to translate them into a format 
for analyzing traffic in the network traffic generation and analysis tool", with respect to claims 1- 
23, have been considered, but are moot in view of new ground of rejection. 



Conclusion 

8. The prior art made of record and not relied upon is considered pertinent to applicant's 
disclosure. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Miranda Le whose telephone number is (571) 272-41 12. The 
examiner can normally be reached on Monday through Friday from 8:30 AM to 5:00 PM. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, John R. Cottingham, can be reached on (571) 272-7079. The fax number to this Art 
Unitis(571)-273-8300. 

Any inquiry of a general nature or relating to the status of this application should be 
directed to the Group receptionist whose telephone number is (571) 272-2100. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http ://p air-d ire ct. uspto . go v . Should you have questions on access to the Private 
PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 



/Miranda Le/ 

Primary Examiner, Art Unit 2167 



